CVE-2024-54140

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-54140", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-11-29T18:02:16.755Z", "datePublished": "2024-12-05T22:08:37.195Z", "dateUpdated": "2024-12-10T14:55:08.151Z"}, "containers": {"cna": {"title": "sigstore-java has a vulnerability with bundle verification", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr"}, {"name": "https://github.com/sigstore/sigstore-conformance/pull/139", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-conformance/pull/139"}, {"name": "https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9"}], "affected": [{"vendor": "sigstore", "product": "sigstore-java", "versions": [{"version": "< 1.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-05T22:08:37.195Z"}, "descriptions": [{"lang": "en", "value": "sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are providing different views of themselves to different clients. There are other mechanisms right now that mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0."}], "source": {"advisory": "GHSA-jp26-88mw-89qr", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "sigstore", "product": "sigstore-java", "cpes": ["cpe:2.3:a:sigstore:sigstore-java:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.2.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-10T14:51:47.403238Z", "id": "CVE-2024-54140", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-10T14:55:08.151Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-54140", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-10T14:51:47.403238Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sigstore:sigstore-java:*:*:*:*:*:*:*:*"], "vendor": "sigstore", "product": "sigstore-java", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-10T14:55:03.418Z"}}], "cna": {"title": "sigstore-java has a vulnerability with bundle verification", "source": {"advisory": "GHSA-jp26-88mw-89qr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-java", "versions": [{"status": "affected", "version": "< 1.2.0"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr", "name": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-conformance/pull/139", "name": "https://github.com/sigstore/sigstore-conformance/pull/139", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9", "name": "https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are providing different views of themselves to different clients. There are other mechanisms right now that mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-05T22:08:37.195Z"}}}, "cveMetadata": {"cveId": "CVE-2024-54140", "state": "PUBLISHED", "dateUpdated": "2024-12-10T14:55:08.151Z", "dateReserved": "2024-11-29T18:02:16.755Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-12-05T22:08:37.195Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sigstore-java", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 1.2.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:sigstore:sigstore-java:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "sigstore-java", "vendor": "sigstore", "versions": [{"lessThan": "1.2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are providing different views of themselves to different clients. There are other mechanisms right now that mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0."}, {"lang": "es", "value": "sigstore-java es un cliente java de sigstore para interactuar con la infraestructura de sigstore. sigstore-java no tiene suficiente verificaci\u00f3n para una situaci\u00f3n en la que un paquete proporciona una firma no v\u00e1lida para un punto de control. Este error afecta a los clientes que usan cualquier variaci\u00f3n de KeylessVerifier.verify(). Actualmente, los puntos de control solo se usan para garantizar que el registro en cuesti\u00f3n proporcion\u00f3 el hash ra\u00edz de una prueba de inclusi\u00f3n. Si no se puede validar eso, un paquete puede proporcionar una prueba de inclusi\u00f3n que en realidad no corresponde al registro en cuesti\u00f3n. Esto puede eventualmente hacer que un monitor/testigo no pueda detectar cu\u00e1ndo los registros comprometidos brindan diferentes vistas de s\u00ed mismos a diferentes clientes. Existen otros mecanismos en este momento que mitigan esto, como la timestamp de entrada firmada. Sigstore-java actualmente requiere una timestamp de entrada firmada v\u00e1lida. Al verificar correctamente la timestamp de entrada firmada, podemos hacer ciertas afirmaciones sobre el registro que firma la entrada del registro (como si el registro estuviera al tanto del evento de firma del artefacto y lo firmara). Por lo tanto, el impacto en los clientes que no son monitores/testigos es muy bajo. Esta vulnerabilidad se corrigi\u00f3 en 1.2.0."}], "id": "CVE-2024-54140", "lastModified": "2026-06-17T08:09:50.757", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-54140", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-10T14:51:47.403238Z", "version": "2.0.3"}}]}, "published": "2024-12-05T22:15:20.400", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-conformance/pull/139"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}